Scam Alerts

Financial regulators are warning consumers about a surge in fraudulent credit offers circulating on social media platforms like Facebook, WhatsApp, and Instagram. These scams involve unauthorized lenders who pose as legitimate financial institutions to deceive victims into paying fictitious upfront fees.

The Federal Motor Carrier Safety Administration (FMCSA) has issued multiple alerts regarding ongoing phishing campaigns targeting motor carriers. Scammers are impersonating government officials to solicit sensitive information, such as Social Security numbers, USDOT PINs, and driver's licenses, through fraudulent emails and lookalike websites.

The Federal Trade Commission (FTC) and FBI have issued warnings regarding predatory for-profit companies that falsely claim to provide 'sextortion assistance' services. These entities exploit victims already in crisis by charging exorbitant fees for ineffective or non-existent services, often using high-pressure tactics and false promises to secure payment.

The U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) has identified approximately $270 million in suspicious financial activity linked to fraud schemes targeting federal student aid programs. These schemes involve the use of stolen identities, 'ghost students,' and complicit 'straw students' to illicitly obtain and launder government funds.

The Cybersecurity and Infrastructure Security Agency (CISA) has identified and added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog throughout October 2026, confirming these flaws are being actively exploited by malicious actors.

The U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) has issued an alert regarding the Iranian regime's exploitation of religious charity networks to fund illicit activities and evade sanctions.

The General Services Administration (GSA) Office of Inspector General has issued a critical alert regarding scammers who are spoofing official government phone numbers and email domains to impersonate federal employees. These fraudsters use caller ID manipulation and look-alike domains to deceive individuals and businesses into providing sensitive personal information, financial details, or making fraudulent payments.

The Financial Supervisory Service (FSS) has issued a consumer alert regarding a sophisticated scam involving fake blockchain networks that impersonate legitimate projects, specifically targeting the upcoming GIWA blockchain network developed by Dunamu.

The U.S. Department of Justice recently concluded a coordinated international 'Joint Disruption Week' targeting transnational criminal networks operating out of West Africa. This operation resulted in multiple arrests, the seizure of electronic devices, and the removal of over 3.7 million accounts used for fraudulent activities.

The Italian Companies and Exchange Commission (CONSOB) has issued multiple urgent orders to block access to numerous websites illegally providing investment and crypto-asset services to Italian investors. These unauthorized platforms often operate without the required regulatory authorization and have been known to use deceptive tactics, including the impersonation of public figures and the misuse of official documentation.

The Commission de Surveillance du Secteur Financier (CSSF) has issued a formal warning regarding a fraud scheme involving individuals who are illicitly misusing the former name of the Luxembourg-based investment firm, Corient S.A. (formerly known as Arche Associés S.A.).

Federal prosecutors have charged two Washington, D.C. residents, Maliktra Derenorcourt and Philippe Oliver Gadie, in a multi-year scheme involving identity theft and housing fraud. The defendants allegedly used stolen and fabricated identities to secure leases at various apartment complexes, subsequently living in the units without paying rent or utilities. The scheme reportedly exploited eviction delays to remain in properties, causing significant financial losses to landlords.

The Cybersecurity and Infrastructure Security Agency (CISA), the FBI, the U.S. Secret Service, and international partners have issued a joint advisory regarding the SafePay ransomware group, which has targeted over 600 critical infrastructure organizations globally since August 2024.

In October 2026, an international law enforcement operation led by the U.K. National Crime Agency and supported by the U.S. Department of Justice successfully disrupted transnational scam networks operating in West Africa. The operation resulted in 28 arrests and the removal of 3.7 million fraudulent online accounts.

Victims of sextortion are being targeted by secondary scams involving 'relief' or 'assistance' services that falsely promise to remove intimate images or stop extortionists for a fee. The FTC has recently taken legal action against companies like Digital Forensics for exploiting these victims.

ConnectWise has suspended several cloud services, including Cloud Backup (formerly SkyKick), SaaS Security, and Cloud Management, following the discovery of unauthorized access to its application identities. Attackers leveraged compromised vendor credentials to gain unauthorized access to 173 Microsoft 365 (M365) tenants.

The PHP Foundation has issued an urgent security advisory regarding two critical vulnerabilities in the PHP programming language, both rated 9.2 on the CVSS v4.0 severity scale. These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, pose a significant risk of remote code execution, potentially allowing unauthorized access or site outages if left unpatched.

The Washington State Bar Association (WSBA) has issued a critical warning regarding a surge in impersonation scams where fraudsters pose as licensed attorneys, legal organizations, or WSBA officials to defraud the public.

Authorities are warning of a sophisticated 'gold bar' and 'bulk cash' courier scam that has resulted in multi-million dollar losses for victims nationwide. Scammers often initiate contact through fake tech support pop-ups, then escalate to impersonating government or law enforcement officials to coerce victims into converting their savings into physical assets for 'safekeeping'.

The Federal Trade Commission (FTC) has taken legal action against Digital Forensics Corporation and its owner, Dmitry Belkin, for operating a fraudulent 'sextortion assistance' scheme that allegedly defrauded victims of at least $60 million.

The City of Albuquerque has enacted a citywide ban on cryptocurrency kiosks (Bitcoin ATMs) due to high rates of fraud, with local officials estimating that 90% of transactions at these machines are linked to illicit activity. This action follows a national trend of rising financial losses associated with crypto kiosks, which are frequently used by scammers to facilitate irreversible, anonymous money transfers.

The Federal Trade Commission (FTC) has filed a lawsuit against Digital Forensics Corporation and its CEO, Dmitry Belkin, for allegedly defrauding sextortion victims of at least $60 million. The company operated various websites, including BlackmailHelpline.com and DigitalForensics.com, promising to stop sextortion attacks, track perpetrators, and coordinate with law enforcement, but failed to deliver these services while using deceptive sales tactics.

The Federal Trade Commission (FTC) has issued an urgent alert regarding the unauthorized sharing of explicit images of children online, including AI-generated deepfakes. This activity is a serious crime, and parents are advised to take immediate steps to report the perpetrators and secure the removal of such content from online platforms.

The Federal Trade Commission (FTC) has filed a lawsuit against Digital Forensics Corporation and its CEO, Dmitry Belkin, for allegedly operating a fraudulent 'sextortion assistance' scheme that defrauded victims of at least $60 million. The company falsely promised to identify perpetrators, stop the spread of intimate images, and coordinate with law enforcement, but often failed to perform these services while charging fees ranging from $1,499 to $20,000.

Fraudsters are increasingly impersonating law enforcement officers to coerce victims into depositing money into Bitcoin ATMs (kiosks) under the false pretense of paying government fees or bond money.

The Federal Trade Commission has issued an urgent alert regarding the unauthorized sharing of explicit images of children online, including AI-generated deepfakes. This activity is a serious criminal offense that requires immediate reporting to law enforcement and proactive steps to remove the content from digital platforms.

On October 8, 2026, U.S. and international authorities issued a joint cybersecurity advisory regarding malicious cyber activity linked to the Chinese government, specifically involving a company called Integrity Technology Group (Integrity Tech).

The Federal Trade Commission has issued an alert regarding the unauthorized sharing of explicit images of children online, including AI-generated deepfakes. Such actions are considered serious crimes, and immediate reporting to law enforcement and specialized organizations is required.

The FBI has issued urgent warnings regarding a surge in fraud schemes where scammers impersonate law enforcement and government officials, including personnel from the Internet Crime Complaint Center (IC3), to target and revictimize individuals who have already suffered financial losses.

Criminals frequently exploit human emotions such as fear, urgency, and the desire for connection to bypass rational decision-making and perpetrate fraud. By creating high-pressure situations or isolating victims, scammers manipulate individuals into sharing sensitive financial information or sending money.

As the Open Enrollment period for Medicare and the Health Insurance Marketplace approaches, the Federal Trade Commission (FTC) and other authorities are warning consumers about a surge in health insurance scams. Fraudsters are actively impersonating government agencies and legitimate insurers to steal personal information, money, or enroll victims in fraudulent plans.

Criminals frequently exploit human emotions—such as the desire for love, financial security, family protection, and safety—to manipulate victims into participating in fraudulent schemes. By establishing emotional connections or creating artificial urgency, scammers override logical decision-making to steal money and personal information.

The FTC is directing consumers to a federal reporting process for online platforms that fail to promptly remove nonconsensual intimate images. Platforms are legally required to provide an accessible way for users to request the removal of intimate photos or videos shared without consent and must remove such content, including known identical copies, within 48 hours of receiving a valid request.

The Federal Trade Commission (FTC) and a coalition of states have filed a lawsuit against the contact lens retailer Lens.com for allegedly using deceptive pricing practices. The company is accused of advertising artificially low prices for contact lenses in search ads and on its website, only to add substantial, mandatory 'Taxes & fees' at checkout that significantly increase the final cost to consumers.

Madison Layton Hollimon, a business owner in Lincolnton, Georgia, was arrested on September 30, 2026, following an investigation into financial transaction card fraud.

The California Department of Financial Protection and Innovation (DFPI) continues to issue warnings regarding ongoing financial fraud, including mortgage-related investment risks and imposter scams targeting consumers and licensees.

The Hong Kong Monetary Authority (HKMA) has issued a warning regarding a fraudulent website impersonating Hong Kong Interbank Clearing Limited (HKICL). Consumers are advised to avoid the site and protect their personal information.

The Cyber Security Agency of Singapore (CSA) issued a security bulletin on September 30, 2026, highlighting critical cyber threats, including the CARBONATO botnet campaign targeting exposed Docker APIs.

Investigations in September 2026 revealed that Polymarket was the target of a significant fraud campaign starting in February 2026, involving attempted theft of at least $10 million via stolen credit cards and potential account takeovers.

Under the federal TAKE IT DOWN Act, online platforms are legally required to provide a clear process for users to request the removal of nonconsensual intimate images and must remove such content within 48 hours of a valid request.

Cybercriminals are actively impersonating Meta support to conduct phishing attacks against Facebook users, often threatening account deletion to induce panic and credential theft.

The FBI has issued a critical warning regarding a surge in government and law enforcement impersonation scams, which have resulted in over $1.6 billion in reported losses between January 2025 and July 2026.

On September 11, 2026, the image-sharing service Gyazo, operated by Helpfeel, suffered a significant data breach after an unauthorized third party exploited a vulnerability in its image upload server. The incident resulted in the exposure of approximately 23.62 million user records and 490 million image metadata records.

The Federal Trade Commission (FTC) has issued a formal warning regarding a surge in scams where fraudsters impersonate legitimate farm equipment businesses to defraud farmers. These scammers create sophisticated, fake websites or social media advertisements for tractors and other heavy machinery, often using the names of real companies to gain trust. Victims are typically coerced into signing fraudulent purchase agreements and sending large sums of money via wire transfer, only to receive no equipment and lose contact with the seller.

The Federal Trade Commission (FTC) has issued a warning regarding deceptive search engine advertisements that impersonate official Medicare and health insurance websites to defraud consumers during Open Enrollment.

The German Federal Financial Supervisory Authority (BaFin) has issued a formal warning regarding the website horizoninvestmentsa(.)com, stating that the operators are offering financial services without the required regulatory authorization.

Following natural disasters, scammers frequently exploit victims by posing as government officials, fake charities, or fraudulent contractors to steal money and personal information.

The Federal Trade Commission has issued guidance for individuals whose intimate images have been shared online without their consent, highlighting new legal protections under the Take It Down Act.

Under the Take It Down Act, online platforms are legally required to remove non-consensual intimate imagery (NCII) and known identical copies within 48 hours of receiving a valid request from the affected individual.

The Federal Trade Commission (FTC) has issued a consumer alert regarding a surge in fraudulent activity where scammers clone legitimate car dealership websites to deceive prospective buyers into making upfront payments for non-existent vehicles.